Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've created my own event log called ScriptEvents that I use a few scripts to write to. What I'd like to do is run these commands (or something equivalent):

Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=1} -MaxEvents 1
Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=0} -MaxEvents 1

then compare their TimeCreated values and perform an action if the first event is older than the second.

This is the output of those commands:

   ProviderName: PauseSnapshots
TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
9/26/2013 11:58:07 AM            1 Information      Replication has been paused....

   ProviderName: ResumeSnapshots
TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
9/26/2013 1:30:42 PM             0 Information      Replication has been resumed....

Any help would be appreciated.

share|improve this question
up vote 4 down vote accepted

I'd probably just use Get-Date and compare as DateTime objects. The following will return True using your provided values.

$evtOne = Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=1} -MaxEvents 1
$evtTwo = Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=0} -MaxEvents 1
(Get-Date $evtOne.TimeCreated) -lt (Get-Date $evtTwo.TimeCreated)
share|improve this answer
-FilterHashTable is nice! – Ryan Ries Sep 27 '13 at 16:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.